Malicious code in nw-demo-utils (npm)

The nw-demo-utils package distributed via npm in versions 1.0.1 through 1.0.24 includes malicious code that compromises any computer on which it is installed or executed. The compromise is severe enough that the attacker may have full control over the system, and simply removing the package may not remove all malicious artifacts. This package is flagged as a malicious package (MAL-2026-5511) and is associated with the GHSA advisory GHSA-q849-7xxq-hh4g.

Systems with the affected versions of nw-demo-utils installed are fully compromised, potentially allowing attackers complete control over the system. All secrets and keys stored on the compromised system are at risk and must be rotated immediately. The presence of this package indicates a severe security breach.

Remove the nw-demo-utils package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems, preferably from a clean, unaffected environment. Because full system compromise is possible, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components.